CVE-2018-7448

published 2018-02-26

CVE-2018-7448: Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code…

Priority P2 58 high 7.5 CVSS 3.0

AV N AC H PR L UI N S U C H I H A H

EXPLOIT

Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cmsmadesimple	cms_made_simple	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /cmsms-2.1.6-install.php/index.php↗

url http://s3.amazonaws.com/cmsms/downloads/13570/cmsms-2.1.6-install.zip↗

path /cms/cmsms-2.1.6-install.php/index.php?mdf68c24c=4↗

command timezone=junk';echo%20system($_GET['cmd']);$junk='junk↗

path /config.php↗

filename config.php↗

• → Monitor POST requests to the installer path containing 'mdf68c24c=4' query parameter, which indicates step 4 of the CMS Made Simple installation — the stage where the timezone injection occurs. ↗
• → Detect PHP code injection patterns in the 'timezone' POST parameter, specifically sequences containing single-quote breaks followed by PHP function calls such as system(), echo, or $_GET references. ↗
• → Alert on GET requests to config.php with a 'cmd' parameter, which indicates post-exploitation webshell access via the backdoored configuration file. ↗
• → Flag any web-accessible cmsms-2.1.6-install.php file that remains present after installation; its continued accessibility is a prerequisite for exploitation. ↗
• → Watch for filesystem permission changes to 777 on the web root or config.php, as the installer forces write permissions that enable the injection. ↗

• · Exploitation requires a fresh (not yet completed) installation and valid database credentials; the vulnerability is not exploitable on already-installed instances unless the installer file is left accessible. ↗
• · The injected payload persists in config.php on disk; remediation requires removing or sanitizing config.php in addition to patching, as the backdoor survives the installation process. ↗
• · The vulnerability was fixed in version 2.2; any instance still running 2.1.6 with the installer file present is fully exploitable. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 8.5 HIGH AV:N/AC:M/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78